Managing user access to Pexip Control Center

Pexip Control Center (PCC) is the platform we're developing to bring the admin and analytics tasks for all users — distributors, partners, company admins and users — into one place.

Compared to the existing tools, PCC allows more granularity in terms of what users have access to, and more flexibility in terms of who can configure access. In this way it enables users to be given the appropriate level of access for their job. It also puts distributor, partner, and company staff in control of access for their own users.

The process starts with Pexip granting roles to selected distributor/partner users who become "access managers" for their business. Access could then be granted as follows, for example:

those access managers can configure roles for their colleagues based on the customers their colleagues work with, and
in turn, those colleagues can grant access to company administrators within the customer companies they work with, and lastly
those company administrators can grant access as required to their own users.

In this article we help distributor and partner users grant roles to others.

Please note all users need an active Pexip Control Center User License before they can access PCC. For general information about PCC, see What is Pexip Control Center?

Understanding roles

Roles are used to determine what a user can do and for which organizations.

Viewer role:
- Gives the user read-only access to organization data.
- Allows the user to launch the Activate Endpoint app to activate/provision compatible hardware video endpoints.
Admin role:
- Gives the user read/write access to organization data.
- Allows the user to launch the Activate Endpoint app to activate/provision compatible hardware video endpoints.
- Allows the user to manage email .
Global Admin role:
- Provides all of the permissions of the Admin and OTJ Admin roles, plus the ability to grant roles to other users.
Admin (legacy) role provides the same access as the Admin role but is automatically assigned by the system to:
- Users whose company administrator role was granted via the Partner Portal or the Pexip apps, both for customer companies and your internal company.
- Users who manage team rooms.
OTJ Admin role gives the user the ability to view and edit the One-Touch Join settings for a company (if they also have the Admin role for that company), and to enable One-Touch Join for individual video systems.
OTJ Viewer role gives the user the ability to view (but not edit) the One-Touch Join settings for a company (if they also have the Viewer role for that company), and to view (but not edit or download the macro for) the One-Touch Join settings for individual video systems.

Note that all standard users with a Pexip Control Center User License have a Member role by default and can log in and view their own personal usage and account details.

What users with Global Admin role can do

As a user with the Global Admin role, you can grant roles to other users:

You can assign any of the roles you have, and for any of the organizations you have access to.
You can grant a user the equivalent or less access than you have yourself, but you cannot give them more access than you have yourself.

To grant a role to a user, you need:

Viewer role for the company to which the user is subscribed. This enables you to view the user's company.
Global Admin role for the company to which the user is subscribed.
Viewer role for the target organization. When granting a role, the drop down list only contains the organizations for which you have Viewer role.
Global Admin role for the target organization.

Finding the Roles page

To go to the user's Roles page:

Use the Overview page to find the company where the user is subscribed.
Go to the Users page to find the user you want to edit, open the menu on the right and select Edit roles.
(If you don't see the option to edit roles, i.e. you can only view the current roles, it means you don't have the Global Admin role for the company whose users you're viewing.)

From the Roles page you can configure a user's roles, see:

Changing the roles a user has for their main organization
Giving a user a role for another organization
Editing or removing the roles a user has for another organization

Changing the roles a user has for their main organization

A user's main organization is the company where they are subscribed. For distributor and partner users this is their internal company.

This feature is used to give roles to users who need to view their own company's data (Overview, Analytics, Users, Video systems and so on), or need to assign roles to staff within their own company. The feature is typically used by:

partners to give Global Admin roles to company administrators for their own company, and
company administrators to give Global Admin roles to users within their company.

These steps show you how to change the roles a user has for their own company:

Go to the Roles page for the user you want to edit.
Select the Roles drop down and you see the roles the user currently has.
Check a selection to add a role or uncheck a selection to remove a role.
Select Apply changes.
There are no automatic email notifications, thus you need to let the user know about their new role.

That's it!

Giving a user a role for another organization

This feature is used to grant a user access to an organization other than the user's subscribed company, and is used by:

Authorized Pexip staff to assign Viewer and Global Admin roles to selected distributor/partner staff.
Distributor/partner staff to give other staff members access. We strongly recommend:
- giving the majority of staff access only to the specific companies they are responsible for, so that the role assignee can support their customers, and
- limiting access for distributor and partner organizations to as few users as possible for the purpose of data analysis via the distributor or partner Overview and Analysis pages.

Recommendations for choosing the right target organization

Important: always grant an appropriate level of access, and take care to select the right organization to avoid providing unauthorized access to data.

Giving a user access to a company type organization grants access to the company only.

We strongly recommend this for the majority of users for the purposes of supporting customers, and for managing your own internal company.

Giving a user access to a partner type organization gives the user access to all the companies below the partner, as well as the partner itself.

We strongly recommend limiting this to as few users as possible for the purposes of data analysis at partner level only.

Giving a user access to a distributor type organization gives the user access to all the partners below the distributor, and all the companies below the partners, as well as the distributor itself.

We strongly recommend limiting this to as few users as possible for the purposes of data analysis at distributor level only.

A user can be granted access to two or more individual companies that are managed by separate partners or distributors.

As in all cases, the person granting access must have the Global Admin role for that particular entity.

Role assignment within the user's company

Role assignment from a partner to a company

Role assignment from a distributor to a company

Role assignment between two companies

How to give someone a role for another organization

The steps below show you how to give someone a role to an organization other than the user's company.

The person granting access must have the Global Admin role for the target entity.

Before making the role assignment, read the guidance about which target organization to choose.

From the top-right corner, select , then you see the controls for adding a role assignment.
Select the Organization drop down and you see a list.
Use the arrow to the right of a name to see partners/companies supported by the organization.
Use the arrow to the left of a name to go back.
Click an organization name at any level to select it as a target organization.
After choosing an organization, select the Access roles drop down.
Use the check box to select the required roles.
Check the configuration is as you want it, and when ready select Submit.
There are no automatic email notifications, thus you need to let the user know about their new role.

Adding roles for another organization

Editing or removing the roles a user has for another organization

First, go to the Roles page.

From the section called Direct roles, select Edit next to the role assignment you want to change.

Direct roles menu for another organization

To change a user's roles for a target organization, click on the Access Roles drop down and use the check boxes.

Access roles selection for another organization

To remove a role assignment completely — all roles for the target organization — select the menu and choose Remove.

Remove direct roles menu option

Inactivity

Users who do not log in to their Pexip Service user account for a long time will eventually lose their access:

After 150 days of inactivity, an email reminder is sent to the user, and then further reminder emails 2 weeks and 3 weeks later, if necessary.
After 180 days of inactivity, the account is deactivated and an email is sent to the user confirming this.

A user is considered active if they log in to PCC, MMV, or the Outlook add-in, or use their personal VMR within a 6-month period.

Access logs

In Settings > Access logs, you can view information about the changes made by users in the PCC. The log data includes:

Local Time: The time according to your device when the change was made or attempted.
Event: The event or change that was made by the user.
Device/Browser: The device and browser used to make the change.
User: The user who made the change.
IP address: The IP address of the user's device.
Status: Whether the change was successful or failed.

By default, the last 90 days of logs are shown but you can adjust the time range from the drop down.

Access logs page